CVE-2026-91002

MEDIUM 5.3

stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.1 is able to resolve this issue. This patch is called d95868dff3da4d3bd4f942837a26cb7c73a797ae. It is suggested to upgrade the affected component. The vendor fixed the issue the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new Blacklist_ALLOWLIST option.

CWE	CWE-306 CWE-287
Vendor	stamparm
Product	maltrail
Published	Sep 15, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for stamparm maltrail

Be the first to know when new medium vulnerabilities affecting stamparm maltrail are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

stamparm / maltrail

3.0.0 3.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403583 vuldb.com: https://vuldb.com/vuln/403583/cti vuldb.com: https://vuldb.com/cve/CVE-2026-91002 vuldb.com: https://vuldb.com/submit/931699 gist.github.com: https://gist.github.com/simyat/fd48e9c257ab95405c109aec575977f1 github.com: https://github.com/stamparm/maltrail/commit/d95868dff3da4d3bd4f942837a26cb7c73a797ae github.com: https://github.com/stamparm/maltrail/releases/tag/3.1 github.com: https://github.com/stamparm/maltrail/

Credits

🔍 inmoyang (VulDB User) VulDB CNA Team